When Blockchain Intelligence Is Not Enough: The Evidential Challenges of Crypto Wallet Freezing Orders
- Sam Healey
- Jul 10
- 8 min read
Digital assets investigations are now a central part of the UK’s asset recovery landscape. The introduction of Crypto Wallet Freezing Orders has given enforcement authorities a powerful tool to preserve digital assets suspected of representing recoverable property or property intended for use in unlawful conduct.
At the same time, blockchain intelligence has transformed the way digital assets are traced. Investigators can now follow the movement of funds across wallets, exchanges, bridges, decentralised platforms and blockchain networks with a level of transparency that does not exist in traditional banking. Whilst this intelligence can provide key insights, it’s not always enough.
This article considers the evidential challenges that arise when blockchain intelligence, attribution analysis and risk indicators are relied upon in Crypto Wallet Freezing Order cases. In particular, it explores the distinction between suspicion and proof, and between blockchain attribution, wallet control and legal ownership.
The gap between blockchain attribution, reasonable grounds to suspect and evidential proof in UK crypto asset investigations.
What can be found below:
The rise of Crypto Wallet Freezing Orders
Crypto Wallet Freezing Orders (CWFOs) form part of the civil asset recovery powers under the Proceeds of Crime Act 2002. They enable enforcement authorities to preserve digital assets where there are reasonable grounds to suspect that the assets are recoverable property or intended for use in unlawful conduct, often before any criminal investigation has concluded.
The making of a CWFO does not establish criminal conduct, prove guilt or determine that the assets will ultimately be forfeited. Rather, it reflects the court’s acceptance (usually without notice to the owner) that the statutory threshold for freezing has been met in order to preserve the status quo pending further investigation.
The critical evidential exercise frequently begins after the order is made, when the respondent is required to explain the provenance, ownership and movement of the digital assets. CWFOs may also be accompanied by Account Freezing Orders (AFOs) where digital assets have been converted into fiat currency held within UK bank accounts.
The consequences can be immediate and significant. Access to digital assets and bank accounts may be restricted, trading activity interrupted, commercial relationships disrupted and reputational harm sustained before the underlying suspicion has been tested. The evidential basis for obtaining a CWFO therefore requires careful scrutiny.
What blockchain intelligence can and cannot prove
Blockchain intelligence combines blockchain analytics, open-source intelligence (OSINT), proprietary datasets and investigative methodologies to associate blockchain addresses with cryptocurrency exchanges, custodians, decentralised protocols, businesses or identifiable individuals. Without this attribution layer, blockchain forensics can reconstruct transaction flows but cannot determine whether beneficial ownership has changed, identify the services receiving the funds or establish where legal or investigative action should be directed.
Blockchain analytics provides a reliable reconstruction of on-chain activity. On Bitcoin, investigators can cluster addresses likely controlled by the same entity using methodologies such as co-spend analysis and change address identification. On account-based blockchains such as Ethereum, investigators can analyse smart contract interactions involving decentralised exchanges (DEXs), bridges, staking protocols and other decentralised finance (DeFi) applications. Although these transactions remain permanently recorded on-chain, interpreting complex smart contract activity frequently requires specialist expertise.
However, attribution must be applied with caution. Incorrect attribution can lead to flawed investigative conclusions. Where assets pass through intermediary wallets or high-activity services, investigators must distinguish between tracing the movement of funds and establishing control of the receiving wallet. Blockchain analysis should therefore extend beyond reconstructing transaction flows to assessing the purpose of transfers, changes in beneficial ownership and the evidential significance of each transaction.
Why attribution is not the same as ownership
One of the most important distinctions in digital assets investigations is the difference between attribution, control and legal ownership.
Blockchain analysis may attribute a wallet to an exchange, custodian, OTC broker or identifiable entity, but attribution alone does not establish beneficial ownership of the assets held within that wallet. Exchange wallets routinely hold assets for thousands of customers, businesses may hold assets on behalf of third parties, and DeFi users or OTC brokers often transact in ways that appear unusual through a conventional financial crime lens but are entirely legitimate within the digital assets ecosystem.
The legal question is not whether a wallet can be linked to suspicious activity, but whether the digital assets held within it constitute recoverable property or are intended for use in unlawful conduct. If suspicion is founded upon mistaken attribution, incomplete wallet analysis or a misunderstanding of legitimate digital assets activity, the basis of the freezing order may become vulnerable when challenged.
The legal threshold: reasonable grounds to suspect
The threshold for obtaining a CWFO is neither proof beyond reasonable doubt nor the civil standard ultimately required for forfeiture. It is a suspicion-based threshold requiring reasonable grounds to suspect.
That suspicion must have an objective evidential basis. In practice, however, digital asset investigations are frequently intelligence-led, arising from Suspicious Activity Reports (SARs), blockchain analytics, exchange alerts, exposure to high-risk wallets or unusual transaction patterns. Such intelligence may justify urgent preservation of assets given the speed with which digital assets can be transferred.
Nevertheless, suspicion is not proof and activity that may appear suspicious through a traditional anti-money laundering lens may have an entirely legitimate explanation. Significant trading gains may result from speculative investment; transfers between wallets may reflect security practices; multiple exchange accounts may reflect liquidity or token availability; and interaction with DeFi protocols may represent legitimate investment strategies rather than concealment. Red flags could justify investigation but do not, of themselves, establish criminality.
Where blockchain analysis is strongest
Blockchain analytics platforms have become increasingly effective at identifying cryptocurrency exchanges and other blockchain service providers, although differences remain, particularly where wallet infrastructure providers and nested services are involved. Correctly identifying the relevant entity is essential when directing disclosure requests, court orders or recovery action. Coverage remains more limited for OTC brokers, private wallets and other services with little public attribution, making OSINT and proprietary research essential.
The transparency and immutability of public blockchains provide a robust evidential foundation. Blockchain tracing enables investigators to monitor addresses, reconstruct transaction flows, identify deposits into exchanges and prepare forensic reports supporting disclosure or freezing applications.
However, a forensic report must distinguish clearly between factual findings and analytical opinion, identify confidence levels and acknowledge evidential limitations.
Assets frequently pass through multiple unattributed wallets, decentralised services and intermediary accounts before reaching a cryptocurrency exchange. Blockchain analysis may demonstrate that funds followed a particular route, but it cannot, without more, establish that the individual retained beneficial ownership or control throughout that route. Where ownership may have changed before the final deposit, attributing the receiving account to an individual risks conflating the tracing of assets with proof of possession or control. In such cases, customer records, KYC information and source-of-funds documentation obtained from the relevant service provider may be essential to establish whether the individual was, in fact, the holder or beneficial owner of the receiving account.
Case study: when blockchain intelligence was not enough
A recent investigation demonstrates the importance of technical context. Significant digital assets trading activity resulted in both a CWFO and an AFO after substantial trading profits were converted into fiat currency and transferred to UK bank accounts. The investigation relied primarily on conventional money laundering indicators, including significant profits, activity across multiple platforms, staking and fiat conversion.
A detailed evidential response reconstructed the digital assets, trading and fiat transactions, identified the original source of funds, reconciled exchange records with banking documentation and explained the underlying trading strategy. Rather than disputing the investigators’ concerns, the response addressed the evidential uncertainty underpinning those concerns.
Following further engagement, the investigating authority accepted that the assets had been legitimately acquired and both freezing orders were discharged without forfeiture proceedings or criminal charges. The case demonstrates that blockchain intelligence cannot be a substitute for comprehensive financial reconstruction, source-of-funds analysis and proper technical context.
The evidential gap between suspicion and proof
Many CWFO cases are ultimately resolved within the evidential gap between initial suspicion and proof. Applications are frequently made urgently on the basis of incomplete intelligence. Whether that suspicion remains sustainable depends upon three complementary strands of analysis:
Legal analysis: whether the statutory requirements for recoverable property or unlawful conduct remain satisfied.
Financial analysis: whether the source of funds, trading activity and fiat transactions can be evidenced through banking and exchange records.
Blockchain analysis: whether the on-chain interpretation is technically sound, attribution reliable and alternative explanations properly considered.
What good blockchain evidence should look like
A blockchain expert report should be clear, methodical and transparent. It should identify the relevant addresses, transactions, assets, timestamps and blockchains, and provide the basis for any attribution and distinguish between established facts, analytical opinion and inference. It should also identify evidential limitations and where additional off-chain evidence is required.
The best blockchain evidence does not simply explain where funds moved. It explains what can properly be concluded from those movements, what cannot be concluded, and what further evidence is required.
A robust forensic report should assist the court in applying the statutory test by clarifying, rather than obscuring, evidential uncertainty.
Lessons for investigators, lawyers and crypto businesses
Investigators should distinguish carefully between suspicion and proof, corroborating blockchain intelligence wherever possible with exchange records, banking material, Know Your Customer (KYC) information, communications and source-of-funds evidence.
Lawyers should challenge the evidential basis of freezing orders through coherent legal submissions supported by financial reconstruction and technically robust blockchain analysis.
For crypto businesses and investors, comprehensive record-keeping which could include exchange statements, wallet histories, transaction records and tax documentation, would remain essential in demonstrating legitimate activity should assets become subject to investigation.
The future of blockchain evidence in asset recovery
Digital assets investigations and the legal framework governing them will continue to evolve. As Crypto Wallet Freezing Orders become more widely used, courts will increasingly be required to determine complex issues of attribution, beneficial ownership, decentralised finance (DeFi) activity, proportionality and third-party interests. The challenge will be ensuring that legal principles keep pace with technological developments without compromising established evidential standards.
Blockchain intelligence has become an indispensable investigative tool, enabling investigators to trace assets, identify points of disclosure and support urgent enforcement steps. However, it rarely provides the complete evidential picture. The ultimate legal question remains whether the digital assets are properly suspected and ultimately shown to constitute recoverable property or property intended for use in unlawful conduct.
Used appropriately, blockchain intelligence strengthens asset recovery by informing legal and investigative decision-making. Used carelessly, it risks creating an unwarranted impression of certainty where the available evidence remains incomplete. As the use of CWFOs expands, the distinction between blockchain intelligence, attribution and evidential proof will become increasingly significant in determining the outcome of digital assets recovery proceedings.
About the Authors
Sam Healey is a Solicitor and consultant, and the founder of SPH Legal, specialising in serious and complex fraud, financial crime, POCA, asset recovery, regulatory investigations and criminal defence. He is ranked by both The Legal 500 - “Sam Healey is a master tactician and is all across every case he does. He is one of the very best” and Chambers & Partners - “He is meticulous, passionate and he provides clients with an exceptional level of service”, and by the Doyle's Guide as a Preeminent Criminal Defence Lawyer. Sam advises individuals, professionals, company directors and businesses in high-stakes investigations, including restraint orders, account freezing orders, crypto-asset freezing, confiscation and civil recovery proceedings.
Recoveris is a specialist blockchain investigations firm providing forensic tracing, asset recovery coordination and expert technical reporting in matters involving digital assets, including fraud, litigation and insolvency. Fred Buret is Director of Digital Asset Investigations at Recoveris and specialises in blockchain forensics, digital asset tracing and the preparation of forensic evidence for litigation, fraud investigations and insolvency proceedings.
This article is for general information only and does not constitute legal advice. Specific advice should be obtained in relation to the facts of any individual case.
